Re: [PATCH] brcmfmac: Fixes potential buffer overflow in 'brcmf_fweh_event_worker'

[Arend Van Spriel <aspriel@xxxxxxxxx>]

On 10/20/2022 10:39 AM, Arend Van Spriel wrote:
> > -        else
> > +        } else {
> > +            if (emsg.bsscfgidx >= BRCMF_MAX_IFS) {
> > +                bphy_err(drvr, "invalid bsscfg index: %u\n", 
> > emsg.bsscfgidx);
> > +                goto event_free;
> > +            }
>
> probably better to do the validation before any other handling. So right 
> after converting the event message at line 245
>
> https://elixir.bootlin.com/linux/latest/source/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c#L245 

Actually, if we ignore the event message we can avoid the whole 
conversion as well doing the validation before the convert.

Regards,
Arend